There must be a way to allow libcouchbase and gocb to utilize the credentials generated by server so the libraries can be used to access buckets from within server. Currently, the credentials are node specific, and the SDKs expect a cluster-wide username and password, and hence it is not possible to utilize them without one of the sides adding support. (The other option is for the code to be vBucket aware and maintain a per node connection pool but at this point, the utility of using an SDK is substantially diminished).
In 5.1, there will be no "run as user" feature. As a result, the functions UI should not take any credentials, and system generated user should be utilized to provide all necessary accesses to resources within the cluster.)